From ab4d688312dc2a4a18dc93e0c68aa7c93165ece7 Mon Sep 17 00:00:00 2001
From: Gordon Messmer <gmessmer@redhat.com>
Date: Tue, 24 Mar 2026 14:46:30 -0700
Subject: [PATCH] Provide instructions to publish dev builds to a local
 container registry

---
 README.md | 42 +++++++++++++++++++++++-----------
 justfile  | 68 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 97 insertions(+), 13 deletions(-)

diff --git a/README.md b/README.md
index 04eb885..6050af1 100644
--- a/README.md
+++ b/README.md
@@ -70,14 +70,12 @@ $ just compose-legacy silverblue
 
 ### Publish an ostree image
 
-Instructions to test the resulting build for classic ostree commits:
-
-- First, serve the ostree repo using an HTTP server. You can use any static
-  file server. For example using
-  <https://github.com/TheWaWaR/simple-http-server>:
+Serve the ostree repo using an HTTP server. You can use any static
+file server. For example using
+<https://github.com/TheWaWaR/simple-http-server>:
 
 ```
-simple-http-server --index --ip 192.168.122.1 --port 8000
+$ simple-http-server --index --ip 192.168.122.1 --port 8000
 ```
 
 ### Install the ostree image
@@ -86,16 +84,16 @@ On an already installed Silverblue system:
 
 ```
 # Pin the currently deployed (and probably working) version
-sudo ostree admin pin 0
+$ sudo ostree admin pin 0
 
 # Add an ostree remote
-sudo ostree remote add testremote http://192.168.122.1:8000/repo --no-gpg-verify
+$ sudo ostree remote add testremote http://192.168.122.1:8000/repo --no-gpg-verify
 
 # List refs from variant remote
-sudo ostree remote refs testremote
+$ sudo ostree remote refs testremote
 
 # Switch to your variant
-sudo rpm-ostree rebase testremote:fedora/rawhide/x86_64/silverblue
+$ sudo rpm-ostree rebase testremote:fedora/rawhide/x86_64/silverblue
 
 # Reboot and test!
 ```
@@ -111,7 +109,19 @@ $ just compose-image silverblue
 
 ### Publish the container image
 
-Push the OCI archive to a container registry
+Serve the container image using a local insecure container image registry.
+
+```
+# Run a local container image registry
+$ podman run -d -p 5000:5000 --name local-registry registry:2
+
+# Push the ociarchive to the image registry
+$ REGISTRY=192.168.122.1:5000 RELEASE_REPO=fedora \
+  just upload-container-simple
+
+# Examine the output for the OCI image location, e.g.:
+# 192.168.122.2:5000/fedora/silverblue:rawhide.20260324.0
+```
 
 ### Install the container image
 
@@ -119,10 +129,16 @@ On an already installed Silverblue system:
 
 ```
 # Pin the currently deployed (and probably working) version
-sudo ostree admin pin 0
+$ sudo ostree admin pin 0
+
+$ sudo tee -a /etc/containers/registries.conf.d/localdev.conf <<EOF
+[[registry]]
+location="192.168.122.1:5000"
+insecure=true
+EOF
 
 # Switch to your variant
-$ rpm-ostree rebase ostree-unverified-image:registry:<oci image>
+$ sudo rpm-ostree rebase ostree-unverified-image:registry:192.168.122.1:5000/fedora/silverblue:rawhide.20260324.0
 
 # Reboot and test!
 ```
diff --git a/justfile b/justfile
index 52dca2e..0830d8c 100644
--- a/justfile
+++ b/justfile
@@ -443,6 +443,74 @@ upload-container variant=default_variant arch=default_arch:
     # Cleanup private key
     rm private.key.b64 private.key
 
+# Upload a container to an anonymous registry. Useful for local builds
+upload-container-simple variant=default_variant arch=default_arch:
+    #!/bin/bash
+    set -euxo pipefail
+
+    {{retry_function}}
+
+    variant={{variant}}
+    arch={{arch}}
+
+    declare -A pretty_names={{pretty_names}}
+    variant_pretty=${pretty_names[$variant]-}
+    if [[ -z $variant_pretty ]]; then
+        echo "Unknown variant"
+        exit 1
+    fi
+
+    if [[ -z ${REGISTRY+x} ]] || [[ -z ${RELEASE_REPO+x} ]]; then
+        echo "Skipping: No REGISTRY or RELEASE_REPO set"
+        exit 1
+    fi
+
+    buildid=""
+    if [[ -f ".buildid" ]]; then
+        buildid="$(< .buildid)"
+    else
+        echo "Skipping: No '.buildid' file"
+        exit 1
+    fi
+
+    version=""
+    if [[ "$(git rev-parse --abbrev-ref HEAD)" == "main" ]] || [[ -f "fedora-rawhide.repo" ]]; then
+        version="rawhide"
+    else
+        version="$(rpm-ostree compose tree --print-only --repo=repo ${variant}.yaml | jq -r '."mutate-os-release"')"
+    fi
+
+    if [[ -n ${CI_REGISTRY_USER+x} ]] || [[ -n ${CI_REGISTRY_PASSWORD+x} ]]; then
+        # Login to the registry
+        retry 5 60 skopeo login --username "${CI_REGISTRY_USER}" --password "${CI_REGISTRY_PASSWORD}" "${REGISTRY}"
+    fi
+
+    image="${REGISTRY}/${RELEASE_REPO}/${variant}"
+
+    # Only append arch suffix if requested
+    suffix=""
+    if [[ ${arch} != "default" ]]; then
+        suffix="-${arch}"
+    fi
+
+    SKOPEO_ARGS=(
+        "--retry-times" "3"
+        "--dest-tls-verify=false"
+    )
+
+    # Support for the zstd:chunked format is not ready yet
+    SKOPEO_ARGS+=("--dest-compress-format")
+    if [[ ${version} == "rawhide" ]] || [[ ${version} == "43" ]]; then
+        SKOPEO_ARGS+=("zstd")
+    else
+        SKOPEO_ARGS+=("gzip")
+    fi
+
+    # Push fully versioned tag (major version, build date/id, arch)
+    retry 5 60 skopeo copy "${SKOPEO_ARGS[@]}" \
+        "oci-archive:${variant}.ociarchive" \
+        "docker://${image}:${version}.${buildid}${suffix}"
+
 # Create a multi-arch manifest for a given variant, push it to a registry and sign it
 multi-arch-manifest variant=default_variant:
     #!/bin/bash